Overview
In This Section |
This section contains the following topics:
|
1. General Safeguarding Procedures
Introduction |
This topic contains information on security and restrictions on release of tax data, including
|
Change Date |
July 20, 2018
|
X.9.B.1.a. Required Safeguards |
As a condition of receiving Federal tax information (FTI), the Department of Veterans Affairs (VA) must establish and maintain, to the satisfaction of the Internal Revenue Service (IRS), certain safeguards that are designed to prevent unauthorized uses of the information and to protect the confidentiality of the information.
Reference: Safeguarding procedures are located within IRS Publication 1075.
|
X.9.B.1.b. Security Briefings |
The Veterans Service Center Manager (VSCM) and Pension Management Center Manager (PMCM) shall ensure that all employees who handle FTI are briefed annually on
A security briefing must be held for each new employee as soon as he/she reports for duty.
Important:
Employee List
A list of the employees attending the briefing must be maintained for two years.After subsequent briefings, the list from two years prior will be destroyed under RCS VB-1, 13-100.300.
|
X.9.B.1.c. Penalties for Tax Information Disclosure |
26 U.S.C. 7213(a)(1) provides that any Federal employee who willfully and unlawfully discloses tax return information may be
It also provides that the employee shall be discharged from employment upon conviction for an unlawful disclosure.
Note: The above disclosure restrictions and penalties apply even after employment has ended.
|
X.9.B.1.d. Taxpayer Civil Suit |
26 U.S.C. 7431(a)(1) permits a taxpayer to bring a civil suit for damages against the United States if any Federal employee knowingly or negligently discloses any tax return information in violation of IRC 6103.
|
X.9.B.1.e.Definition: Need to Know |
When access to FTI is needed, it may be obtained, but only by employees with aneed to know.
Definition of Need To Know
Need to know is defined as an individual who requires access to FTI to perform their official duties (e.g. a file is needed by an employee when the income recipient is in the office and is asking to see the information). Employees of the Board of Veterans’ Appeals (BVA) are considered to have a need to know if a claim containing FTI is appealed.
Reference: For more information on transferring FTI on an appeal issue, see M21-1, Part X, 9.B.2.k and l.
|
X.9.B.1.f.Minimum Protection Standards |
Minimum Protection Standards are designed, by IRS, to provide agencies with a basic framework of minimum security requirements. The objective of these standards is to prevent unauthorized access to FTI and thus requires two of the following four barriers:
Explanations of these barriers are provided in IRS Publication 1075. Note that while two barriers are required, during duty hours, employees need not lock FTI in a locked box if they step away from their desks for a short period of time without leaving the general vicinity. They should avoid leaving FTI out in the open, and should take practical measures to avoid inadvertent and unauthorized disclosures of FTI.
During non-duty hours, employees must ensure documents containing FTI are stored in a locked box or secondary locked location (security room or security container) to prevent disclosures to unauthorized personnel.
Important: Keys to a locked box or locked location must not be stored in the same location as the locked container, such as desk drawer in the same room.
|
X.9.B.1.g. Transporting FTI |
Employees transporting FTI between a primary location to a secondary location (i.e., building to building) need to secure the FTI in a locked security container during transport.
Note: The transporting and receiving location must log the FTI in accordance withM21-1, Part X, 9.B.2.j.
|
X.9.B.1.h. Prohibition of Releasing Information by Fax |
Faxing FTI is strictly prohibited.
|
X.9.B.1.i. E-mailing FTI |
Do not include FTI within an email or as an attachment to any recipient.
Send policy questions pertaining to FTI in an encrypted email toVAVBAWAS/CO/PENSION POL & PROC. Include only the claim number and the specific question.
Note: VA Central Office employees may, on occasion, initiate e-mails containing FTI so long as the IRS guidelines in IRS Publication 1075 are met.
|
X.9.B.1.j. Releasing Information Over the Telephone |
VA employees may only speak directly to the individual whose FTI data was received. Speaking with a relative, spouse, or a friend even if the individual who received the income grants permission, is not allowed.
Telephone development is allowed to
Example: IRS reports dividend income of $2,000 per year; however, the claimant did not report dividend income. The VA employee calls the claimant and the claimant explains that he did not think to include the dividends as he has the dividend payments set up to automatically roll over into his savings account and that the $2,000 is accurate. Since the claimant has confirmed the FTI, the VA employee can use the call as verification.
Important: VA employees may not accept a statement taken over the phone as verification of a claimant’s income if the amount is less than FTI reported by IRS and SSA.
Reference: For information regarding disclosures to Fiduciaries, see M21-1, Part X, 9.B.4.
|
X.9.B.1.l. IR Policy and Reporting Procedures |
Upon discovering a possible improper inspection or disclosure of FTI, to include breaches and security incidents, an Assistant VSCM (AVSCM) or PMCM (APMCM) must contact the office of the appropriate special-agent-in-charge, Treasury Inspector General for Tax Administration (TIGTA) immediately, but no later than 24 hours, after identification of a possible issue involving FTI.
Note: Call the local TIGTA Field Division Office first located within IRS Publication 1075. If unable to contact the local TIGTA Field Division, contact the National Office Hotline Number: 1-800-589-3718.
Concurrently to contacting TIGTA, an AVSCM or APMCM must send an incident report to the Office of Safeguards mailbox at safeguardreports@irs.gov using the IRS-approved encryption techniques. Use the term Data Incident Report in the subject line of the email. The incident report should include, but is not limited to:
Important: Do not include FTI in the incident report. Even if all information is not available, immediate notification is the most important factor, not the completeness of the data incident report.
Note: The VSCM and PMCM shall ensure each RO develops and maintains an incident response (IR) policy that addresses roles and responsibilities pertaining to data breaches involving FTI in accordance with IRS Publication 1075, Sections 9.3.8 and 10.0.
Reference: For definitions of inspection and disclosure, see IRC 6103(b)(7) and (8).
|
X.9.B.1.m. Quarterly Reports Required for Improper Inspection or Disclosure of FTI |
ROs are required to submit a quarterly report, Improper Inspection or Disclosure of FTI, on the number of improper inspections or disclosures of FTI. Quarterly reports are due 14 working days after the end of the following months:
Reports are required in the following format:
PMCs must email their reports to: VAVBAWAS/CO/21P1_IRS/SSA. VSCs must email their reports to: VAVBAWAS/CO/212A.
Note: If a VSC/PMC had zero instances of improper inspections or disclosures for a particular quarter, then a negative response is required to the appropriate mailbox when the report is due.
|
2. Storing and Handling of FTI
Introduction |
This topic contains information on storing and handling FTI including
|
Change Date |
July 20, 2018
|
X.9.B.2.a. VSC FTI Storage |
VSCs must establish an orange, lightweight folder for each case requiring further action. Tax return information (for example, the worksheet), must be filed in the FTI folder, previously referred to as Income Verification Match (IVM) folders. FTI folders must be kept separately in a locked file. The FTI folder must be returned to the locked files at the end of each day. There are no exceptions. Attach an overprint flash to the claims folder to alert employees that there is an FTI folder.
Important: Charge cards must be used to maintain a complete record of charge-outs and must also reflect the date files are returned to storage.
Reference: For more information on the maintenance and release of locked files, see M21-1, Part III, Subpart ii, 4.A.3.
|
X.9.B.2.d. Removing an FTI Document Within VBMS and Securely Storing Within LCM |
If a PMC/VSC employee discovers an FTI document within VBMS, print out all FTI documents and send for imaging and storage in the secure Legacy Content Manager (LCM) folder.
Once imaged and securely stored, call-in or create a service desk ticket for tracking purposes for VBMS. An AVSCM or APMCM must send an email to the VBMS POC requesting deletion of the FTI documents. Use the term FTI Documents in VBMS in the subject line of the email. The email must contain:
Important: Do not include FTI in the email.
Once a confirmation email is received from VBMS stating the documents in question have been deleted, close/resolve the service ticket created, if applicable.
References: For more information on
|
X.9.B.2.f. Award Prints |
Keep FTI-related award prints in the claims file. Annotate the award print, See FTI Folder, to alert others that the documentation supporting the award action is in the FTI folder.
Exception: If the award print has been annotated with FTI, the award print may no longer be stored in the claims file. It must be stored in the FTI locked file or in the LCM secure folder.
|
X.9.B.2.g. Destroying Contents of the Paper FTI File |
An FTI folder and its contents may be destroyed three years after a final decision, based on Federal tax return information, has been made by the VSC, PMC or appellate body. Any identifying information on the file will be shredded.
Exception: The IVM worksheet from a case requiring a benefit adjustment may be destroyed 30 days after the decision becomes final.
Reference: For information on disposal of the IVM worksheet when verification and further development are unnecessary, see, M21-1, Part X, 9.C.5.
|
X.9.B.2.h. Destroying Scanned FTI |
For any paper FTI materials imaged and stored in the secure LCM folder, regional offices (ROs) need only retain any paper FTI (which includes any extraneous copies, photo impressions, printouts, carbon paper, notes, stenographic notes, and work papers) materials for 90 days, after imaging quality control is complete.
Below are the procedures for destroying paper FTI materials.
Important: After the materials have been destroyed, store the log for five years from the date of destruction of the last item on the log.
Exception: The IVM worksheet from a case requiring benefit adjustment may be destroyed 30 days after the decision becomes final.
|
X.9.B.2.i. Requirements for Destroying FTI |
FTI must be destroyed by being
Note: Microfilm and microfiche must be destroyed by burning.
|
X.9.B.2.j. FTI Tracking Log (VSC and PMC) |
Retain an FTI tracking log to document the creation, movement, and/or destruction and content of
The designee of the PMC or VSC Manager must maintain the log.
If using the log to track disposal and if all Federal tax return materials for a particular year are destroyed, the log does not have to identify each individual record destroyed. It is adequate to document that all Federal tax returns for a particular year were destroyed in accordance with established procedures.
If only part of any particular year’s tax materials are destroyed, the disposal log must record the
Note: The RO may place a paper flash on the FTI generated, in lieu of a log, so long as the required information is on the paper flash.
Example:
![]() Important:
Destroying the Log and/or Paper Flash
The log and/or paper flash may be destroyed five years after the destruction of the last item entered in the log or on the flash.
|
X.9.B.2.k. Transferring FTI Materials When Scanning is Possible |
If the claims folder is transferred to another location, the FTI must be available to the receiving location (BVA, another RO, Office of Inspector General, Committee on Waivers, etc.).
Prior to sending the folder, all remaining FTI in orange light-weight folders should be scanned into the secure LCM folder. Once completed, a flash should be placed in the claims folder noting that FTI is contained in the secured LCM folder.
Important: Log the scanned FTI in accordance with M21-1, Part X, 9.B.2.i.
|
X.9.B.2.l. Transferring FTI When Scanning Can Not Be Done |
If scanning cannot be done and the paper FTI must be transferred to another RO, take the steps below.
Important: The transporting and receiving location logs the FTI in accordance withM21-1, Part X, 9.B.2.i.
|
3. Disclosure of FTI
Introduction |
This topic contains information on FOIA requests, including
|
Change Date |
December 21, 2017
|
X.9.B.3.a. Releasing FTI |
FTI can be released only as permitted by IRC 6103. Generally, tax return information may be released to the taxpayer, usually the income payer or income recipient.
|
X.9.B.3.b. FOIA Request for Tax Information by Someone Other Than a Taxpayer |
If a Freedom of Information Act (FOIA) request for tax return information is received from someone other than the tax payer, the written reply to the FOIA request must tell the requester that IRC 6103 prohibits disclosure of tax return information in response to a FOIA request and cite FOIA exemption (b)(3).
The reply also must advise the requester of the right to appeal the withholding of this information to VA General Counsel. Questions concerning the release of tax return information to anyone other than the taxpayer should be referred to the Regional Counsel. To find your local Office of General Counsel (OGC), see theOGC website.
|
X.9.B.3.c. Disclosure to POA |
VA may disclose tax return information to an individual or a service organization designated by the individual that the tax information pertains to. For FTI purposes, the assignment of a service organization as power of attorney (POA) is restricted to five years from the date the VA Form 21-22, Appointment of Veterans Service Organization as Claimant’s Representative is signed. If the beneficiary and his/her spouse are both income recipients for the same tax year match, each must execute a separate POA.
The individual representative of a Veteran’s service organization need not be a named individual. It is sufficient that VA Form 21-22 contain the job title.
Example: “any DAV service officer,” of the service organization representative.
If IVM development action appears necessary and the date the VA Form 21-22was signed exceeds five years, or will likely be so before the FTI action is completed, then forward the claimant a new VA Form 21-22 to complete.
Note: If a specific person is named on VA Form 21-22, access should be limited to only that individual.
|
X.9.B.3.d. Prohibition of Releasing FTI to a Member of Congress |
Do not release FTI to a Member of Congress. If a Congressional inquiry is received as a result of a proposal to reduce or terminate benefits or after benefits have been reduced or discontinued, inform the Member of Congress that
Note: The exact amount of reduction may be furnished.
|
X.9.B.3.e. Releasing Non-FTI |
Information which is not FTI, including income information provided to VA by an income payer including copies of W-2s or IRS Form 1040s filed with the IRS, may be released to a Member of Congress only when the Member of Congress seeks the
|
X.9.B.3.f. Committee on Waivers Decisions |
Copies of Committee on Waivers decisions, including relevant tax return information, may be referred to the Debt Management Center.
|
X.9.B.3.g. FOIA Requests Relating to Safeguard Reports and Documents |
Safeguard Reports and related documents in possession of Federal, state, and local agencies are considered the property of the IRS. They are subject to disclosure restrictions under Federal law and IRS rules and regulations and may not be disclosed to anyone outside the agency. Use the below language to respond to a Freedom of Information Act (FOIA) request, Sunshine or Information Sharing request, and/or Open Records provisions request to include, but not limited to:
You have requested reports that are property of the Internal Revenue Service (IRS). Any request for the release of IRS records is subject to disclosure restrictions under Federal law and IRS rules and regulations. To obtain these records, you must file a Freedom of Information Act (FOIA) request with the IRS. For more information on how to file a FOIA request with the IRS, please visit https://www.irs.gov/uac/IRS-Freedom-of-Information.
|
4. Limitation on Fiduciary Contact
Introduction |
This topic contains information on limitations on fiduciary contact, including
|
Change Date |
December 21, 2017
|
X.9.B.4.a. IRS Limits on VA |
IRS regulations do not permit VA to disclose FTI to a fiduciary for verification of FTI unless the fiduciary is a court-appointed guardian. If the corporate record shows the beneficiary is incompetent and not being paid directly, send verification letters to the beneficiary and/or beneficiary’s spouse (the person the FTI was received on).
Important: Coordination will be required with fiduciary hubs to obtain the beneficiary’s mailing address as it may differ from the fiduciary address.
Reference: For more information on notifying a Federal fiduciary of a monetary benefit, use the language found in M21-1, Part X, 9.B.4.f.
|
X.9.B.4.b. Fiduciary Worksheets Prior to FY15 |
Prior to Fiscal Year (FY) 2015, worksheets for fiduciary cases were sent separately to the PMCs with a transmittal stating that the referrals were fiduciary cases. These cases must be reviewed to determine which have court-appointed guardians.
|
X.9.B.4.c. Verifying FTI in Court-Appointed Guardian Cases |
If there is a court-appointed guardian, ask the guardian to verify the FTI via a letter.
|
X.9.B.4.d. Verifying FTI in Federal Fiduciary Cases |
If the payee is a Federal fiduciary who is appointed by VA only, ask the income recipient to verify the FTI via a letter.
|
X.9.B.4.e. VA Fiduciary Underreported Income |
If it is determined that a VA fiduciary underreported income, notify the fiduciary activity via a letter at the time of reduction or discontinuance.
|
X.9.B.4.f. Notifying Federal Fiduciaries of Award Changes |
Award letters containing rate changes may be sent to a Federal fiduciary only if FTI is not contained within the letter. If FTI is contained within the letter, send a separate letter notifying the fiduciary of award changes using the following language:
We are contacting you because we have adjusted [insert beneficiary’s name] award due to federal tax information (FTI) that was previously unreported. We have sent letters directly to [insert beneficiary’s name] regarding this issue because federal law prohibits us from disclosing FTI to anyone other than the taxpayer unless the fiduciary has been appointed by a court of law. If you have been appointed fiduciary by a court of law, please provide us evidence of the appointment.
We have adjusted [insert beneficiary’s name] payments as follows:
[Insert rate and effective date table from beneficiary’s letter.]
|
5. Internal Inspections Report
Introduction |
This topic contains information on Internal Inspections Report (IIR), including
|
Change Date |
July 20, 2018
|
X.9.B.5.a. Inspection of Security Procedures |
Every three years, a person designated by the Director must conduct an independent inspection of security procedures. This review must be conducted by someone who does not access FTI and has no authority or responsibility for maintenance of claims files.
Example: A management analyst in the Director’s office.
The schedule is located on the Pension and Fiduciary (P&F) Service web site under Pension, Federal Tax Information (FTI) Match.
|
X.9.B.5.b. Information to Include in the IIR |
Include the following items in the written report:
Reference: For more information on the template for the IIR , see the Pension, Federal Tax Information (FTI) Match.
|
X.9.B.5.c. IIR Retention |
The inspection records will be filed in a separate file and for purposes of meetingIRC 6103(p)(4) requirements, will be retained for a period of five full years (even if reviewed by the IRS). At that time the inspection records may be destroyed.
|
X.9.B.5.d. Deficiencies |
If any unresolved deficiencies are noted during the reporting period, the RO management analyst (or designee) will
|
X.9.B.5.e. Where to Send Reports and Direct Questions |
PMCs must email their reports to: VAVBAWAS/CO/21P1_IRS/SSA. VSCs must email their reports to: VAVBAWAS/CO/212A.
|
X.9.B.5.f. Disclosure of the Report |
IIRs are property of the IRS subject to disclosure restrictions under Federal law and IRS rules and regulations and may not be disclosed to anyone outside the agency.
Reference: For more information on language to use when responding to a request for an IIR outside the agency, see M21-1, Part X, 9.B.3.g.
|
6. FTI Destruction Memorandum
Introduction |
This topic contains information on FTI Destruction Memorandum (memo), including
|
Change Date |
July 20, 2018
|
X.9.B.6.a. Reporting Destroyed FTI |
Each year, all facilities that have the ability to access, store, process, and/or transmit FTI must submit a FTI Destruction Memo.
Include the following items in the Memo:
Note: The Memo must be signed by the Director (electronic or wet signature) or designee.
Reference: The Office of Field Operations disseminates the FTI Destruction Memo via email by December 1 of the reporting calendar year.
|
X.9.B.6.b. When to Submit the FTI Destruction Memo |
The FTI Destruction Memo is due no later than January 5 of the next calendar year (i.e. January 5, 2018 to report calendar year 2017 FTI destroyed).
|
X.9.B.6.c. Where to Send Reports and Direct Questions |
PMCs must email their reports to: VAVBAWAS/CO/21P1_IRS/SSA. VSCs must email their reports to: VAVBAWAS/CO/212A.
|
X.9.B.6.d. Disclosure of the Memo |
FTI Destruction Memos are property of the IRS subject to disclosure restrictions under Federal law and IRS rules and regulations and may not be disclosed to anyone outside the agency.
Reference: For language to use when responding to a request for a FTI Destruction Memo outside the agency, please see M21-1, Part X, 9.B.3.g.
|
12-21-17_Key-Changes_M21-1X_9_SecB.docx | May 19, 2019 | 102 KB |
7-20-18_Key-Changes_M21-1X_9_SecB.docx | May 19, 2019 | 91 KB |
Change-March-30-2015-Transmittal-Sheet-M21-1MR_X_9_SecB_TS.docx | May 19, 2019 | 48 KB |
Related Articles